Connect Okta to Microsoft Azure Sentinel

Azure Sentinel is Microsoft’s new cloud-native Security Incident and Event Management (SEIM) tool. If you use Azure AD (AAD) for your single-sign on (SSO) identity provider (IDP) for your SaaS apps, those AAD logs will seamlessly integrate with Azure Sentinel with the check of a box.

Azure Sentinel configuration for Azure AD

However, if you’re using Okta as your IDP, this can also natively integrate very easily with Sentinel so you get your identity logs into your SIEM. To get started, first go to your Okta Admin portal and navigate to Security -> API -> Tokens. Create a token (call it something like AzureSentinelAPI or whatever your naming convention is). Make sure you copy the API to a safe location.

Create a new API token

Navigate to Azure Sentinel and search for the Okta connector and open the connector page.

Azure Sentinel Okta Connector

Once you open the connector page, there are two options on how to deploy the connector. The first is an automated deployment of an Azure Resource Manager (ARM) template. This is the easiest method. If you want, you can manually deploy the Azure functions separately as well.

Following Options 1, click the Deploy to Azure button. Pick the subscription and resource group that your Azure Sentinel deployment is home to. Fill in your Workspace ID and Workspace Key for your Azure Sentinel Workspace. Fill in the API token from Okta. Change the URI under <Okta domain> to your Okta URL.

Configure ARM template

Deploy and you’re done! Under next steps, you can run the query samples to make sure your logs are coming in. You should also create the analytic rules to get notified whenever there’s a security alert of concern.

Next Steps

Finally, in the Azure Sentinel Github, there’s a very handy workbook that you can import into your environment to get a rich table of data. Use the provided link and click on “Raw.”

Azure Sentinel Github

Copy and paste the text and go to the Azure Sentinel console and select “+Add workbook” under Workbooks.

Add Azure Sentinel Workbook

Click “Edit” and select Advance Editor.

Advance Workbook Editor

Paste the Github text over the sample text in the Gallery Template and save the workbook. Done! You’ve successfully onboarded Okta to Azure Sentinel and configured a workbook to have a rich layer of data to display for you to comb through.

Let me know if you have any questions!

--

--

--

Cybersecurity Engineer | Veteran | Podcaster

Love podcasts or audiobooks? Learn on the go with our new app.

Recommended from Medium

HouseBoss

Doraemon and his gadgets

Let Siri Control Your Raspberry

My Learning Journey (PostgreSQL)

How to Install Java in Windows 10, 7, 8.1, XP?

Clarity’s Code Values

Sense — Hack The Box [Write-up]

C# for JavaScript Developers: Basic Exercises 02

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
ajawzero

ajawzero

Cybersecurity Engineer | Veteran | Podcaster

More from Medium

About Kubernetes architecture (2)

Data Structure & Algorithms — Tree Traversal

GKE Operations on Google Cloud

IP Address management in GKE — https://cloud.google.com/blog/products/containers-kubernetes/ip-address-management-in-gke

How Azure Resource Manager simplifies management of your Azure resources